When Encapsulating Security Payload (ESP) is used in the tunnel mode, a new IP header is computed and added. Why is this necessary? Thank you.

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 28 '17 at 22:52

A tunnel wraps packets inside other packets, so you have different packet headers for the outer packets. This is true even if the tunnel is not encrypted, e.g. GRE.

  • Would you mind to explain it more? Thank you very much. – ng2b30 Apr 30 '17 at 17:23
  • What else is there to explain? If you tunnel packets, that means that you encapsulate packets inside other packets, and the routing happens based on the outer packet headers. The inner packets may or may not be encrypted. – Ron Maupin Apr 30 '17 at 17:26
  • 1
    Here's an explanation of GRE tunneling. Replace GRE with ESP, and you will have the gist of it. incapsula.com/blog/what-is-gre-tunnel.html – Ron Trunk Apr 30 '17 at 18:41

In tunnel mode, the entire original IP packet is protected by IPSec or ESP. ESP is an IP protocol with a protocol number. It lacks the necessary information to be routed to the destination.

For this reason a new IP header is added, so the destination can be reached. Without an IP header, there is no way to transmit the traffic.

Short answer, ESP is not IP.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.